NTLM pass-the-hash shows why Active Directory controls still matter

At a glance

What this is: This is an analysis of why NTLM pass-the-hash still works in Active Directory and how protocol-level weakness turns a local compromise into lateral movement.

Why it matters: It matters because IAM teams cannot treat MFA as a complete defence when legacy authentication protocols still permit hash reuse, credential theft, and privilege spread across enterprise environments.

👉 Read IS Decisions' analysis of NTLM pass-the-hash and Active Directory risk

Context

NTLM pass-the-hash is a legacy authentication problem that becomes an identity security problem when old protocol behaviour still exists inside modern Active Directory estates. The key issue is not password guessing but reuse of cached hash material that can be replayed after a workstation compromise, which means protocol choice and access scope both shape the breach outcome.

For IAM, PAM, and security architecture teams, this is a reminder that authentication controls must be evaluated at the protocol layer, not only at the MFA layer. If legacy fallback paths remain enabled, attacker movement can continue even when interactive login protections are in place.

Key questions

Q: What breaks when NTLM is still enabled in Active Directory?

A: NTLM preserves a replayable trust path that attackers can abuse once they obtain cached hash material from a compromised endpoint. The result is not just weaker authentication, but a lateral movement path that bypasses password cracking and can turn one host compromise into broader directory access.

Q: Why does MFA not stop pass-the-hash attacks?

A: MFA protects the interactive login step, but pass-the-hash abuses the protocol after identity material has already been accepted. If the attacker can replay a valid hash inside NTLM, the protocol may treat that replay as sufficient evidence, which means MFA never gets a chance to intervene.

Q: How can security teams reduce the chance of hash theft from Windows endpoints?

A: The most effective reduction comes from limiting local admin rights, restricting where administrators can log on, and protecting memory areas such as LSASS. Those controls reduce the chance that an endpoint compromise becomes a credential harvesting opportunity.

Q: How should teams respond when legacy authentication is still needed for compatibility?

A: Treat compatibility as a controlled exception, not a permanent state. Keep the number of NTLM-dependent services as small as possible, watch for abnormal session behaviour, and apply contextual access controls so that any residual fallback path is tightly constrained and observable.

Technical breakdown

Why NTLM still enables hash replay in Active Directory

NTLM uses a challenge-response model that is older than Kerberos and fundamentally less resilient. When a user authenticates, the hash material is cached in memory so the system can re-authenticate without asking for the password again. That design created convenience and backward compatibility, but it also created a reusable secret. Pass-the-hash works because the attacker does not need the cleartext password. If they can obtain the hash from memory, they can present it to NTLM-enabled services and authenticate as the victim.

Practical implication: inventory and eliminate NTLM fallback paths before assuming password policy changes will reduce lateral movement risk.

How workstation compromise turns into domain movement

PtH usually starts after an attacker gains local admin rights on a workstation, often by exploiting a software flaw or weak service configuration. With those rights, they can access LSASS memory, where hashes and Kerberos tickets may be present. The attacker then reuses the captured hash against services the user can access, which turns one compromised endpoint into a bridgehead for broader identity abuse. Over time, ordinary user accounts can accumulate access, and admins who log into compromised hosts can unintentionally expose higher-value credentials too.

Practical implication: harden LSASS exposure and restrict admin logons to reduce the chance that one endpoint becomes a credential harvesting point.

Why MFA does not close protocol-level authentication abuse

MFA helps at the login boundary, but it does not rewrite how NTLM authenticates once the protocol is in use. That means an attacker who already has a reusable hash can bypass the stronger factors because the protocol itself is the trust anchor. The control gap is not user verification at sign-in, but the continued existence of a protocol that treats cached identity material as sufficient evidence of access. Contextual access controls, session limits, and monitoring can slow the attacker, but they do not change the core protocol weakness.

Practical implication: treat MFA as a foothold-reduction control, not as a compensating control for NTLM pass-the-hash.

Threat narrative

Attacker objective: The attacker wants to move from a single compromised endpoint into broader Active Directory access while avoiding password cracking and interactive authentication challenges.

1. Entry begins when an attacker compromises a user workstation or gains local administrative rights through a software vulnerability or misconfigured service path.
2. Escalation occurs when the attacker accesses LSASS memory and captures the NTLM hash or related cached identity material.
3. Impact follows when the attacker replays the hash across reachable services, impersonates the user, and expands access laterally toward additional credentials or domain compromise.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Pass-the-hash is a standing-credential problem, not just an authentication problem. NTLM allows identity material to persist in memory long enough to be replayed, which means the attack lives in the gap between login and session reuse. The important lesson for identity governance is that access can be stolen without ever being re-entered by the user. Practitioners need to treat any protocol that permits reusable authentication material as a lateral movement enabler.

Protocol fallback is a governance decision with security consequences. NTLM survives because organisations value compatibility, but compatibility also preserves attack surface. The decision to keep fallback paths alive effectively extends the lifetime of a protocol that predates modern Zero Trust assumptions. That means the real issue is not whether NTLM is deprecated on paper, but whether governance still tolerates it in production.

LSASS exposure creates the practical bridge from compromise to impersonation. Once local admin rights exist on a workstation, cached hashes and tickets become reachable for harvest and reuse. That makes endpoint privilege, not just directory policy, part of the identity security boundary. The implication is that access scope on endpoints determines whether a single compromise becomes a reusable identity event.

Layered access controls can shrink blast radius, but they do not restore protocol trust. Session restrictions, contextual access, and monitoring make PtH harder to execute at scale, yet they operate after the protocol has already accepted the hash. The control lesson is that containment matters when legacy protocols persist, but the governance conclusion is that compensating controls should never be mistaken for protocol safety.

From our research:

• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%), according to The State of Non-Human Identity Security.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, including 38% with no or low visibility and 47% with only partial visibility, according to Astrix Security & CSA.
• Use the Ultimate Guide to NHIs , Key Challenges and Risks to align legacy protocol cleanup with visibility, rotation, and over-privilege remediation.

What this signals

NTLM persistence is a reminder that legacy identity behaviour still governs modern risk. As long as protocols continue to cache reusable identity material, incident response must assume that a single endpoint compromise can become a directory-wide access event. Teams that still depend on fallback authentication should prioritise visibility into where that fallback exists and how often it is used.

A mature programme will treat protocol retirement, endpoint privilege reduction, and session monitoring as one control problem rather than three separate projects. That matters because identity compromise is often the starting point for broader movement, not the end state.

For practitioners

• Map and remove NTLM fallback dependencies Identify applications, services, and legacy workflows that still rely on NTLM and set a phased retirement plan. Prioritise systems where fallback authentication exists only for convenience, because those paths preserve the hash replay opportunity that pass-the-hash exploits.
• Restrict privileged logons to trusted endpoints Block administrators from signing into unmanaged or high-risk workstations, especially where Remote Desktop is used. Reducing admin exposure on potentially compromised hosts limits the chance that LSASS memory contains credentials worth stealing.
• Harden LSASS and local admin exposure Apply controls that reduce credential access on endpoints, including least privilege for local admin rights and monitoring for suspicious memory access. If an attacker cannot reach cached hashes, pass-the-hash becomes much harder to execute.
• Use MFA as a foothold reducer, not a closure control Keep MFA in place to make initial compromise harder, but do not assume it blocks replay of captured NTLM hashes. Pair MFA with contextual access controls and real-time monitoring so that suspicious re-authentication patterns can be detected and contained.
• Limit concurrent sessions and odd-time access Set alerts for concurrent sessions, unusual login timing, and atypical source hosts so that reuse of a compromised identity is easier to spot. These signals are especially valuable when an attacker tries to pivot from one account to adjacent resources.

Key takeaways

• Pass-the-hash succeeds because NTLM preserves reusable identity material that attackers can replay after endpoint compromise.
• MFA alone does not block protocol-level abuse, so access scope, endpoint privilege, and session monitoring become the deciding controls.
• The practical answer is to reduce NTLM exposure, constrain privileged logons, and make credential harvesting materially harder on Windows hosts.

Key terms

• Pass-the-Hash: An authentication abuse technique where an attacker uses a stolen password hash instead of the cleartext password. It matters in Windows environments because cached credentials can sometimes be enough to gain access, turning one compromised host into a broader lateral movement opportunity.
• NTLM Relay: NTLM relay is an attack technique where an authenticated challenge-response session is captured and forwarded to another service that accepts it as legitimate. The attacker does not need the password itself, only a reusable authentication exchange that the target will trust.
• LSASS: LSASS is the Windows process that enforces local security policy and handles authentication-related operations. If LSASS crashes, the domain controller can reboot or lose authentication capability, making it one of the most sensitive failure points in enterprise identity infrastructure.

What's in the full article

IS Decisions' full post covers the operational detail this analysis intentionally leaves for the source:

• Step-by-step explanation of how NTLM caches hashes in memory and how PtH reuses them across services
• Examples of access controls such as MFA on UAC prompts, concurrent session limits, and context-based restrictions
• Discussion of when Remote Desktop and admin logons expose credential material on compromised hosts
• The article's comparison of NTLM fallback trade-offs versus Kerberos-based authentication

👉 The full IS Decisions post covers the NTLM attack path, compensating controls, and compatibility trade-offs in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity programme, it is worth exploring.